Deploy Secure Mesh Site v2 with Amazon EKS (ClickOps)

Overview

Use F5 Distributed Cloud Console to deploy a Distributed Cloud Customer Edge (CE) with Amazon Elastic Kubernetes Service (Amazon EKS) as the provider.

Important: This guide doesn't provide instructions on how to deploy an F5 App Stack Site.

About this provider

This is early access (EA) functionality and can be used for proof-of-concept (PoC) or proof-of-value (PoV) deployments. The functionality will be made generally available (GA) over the next couple of releases. Reach out to your account representative for more information.

Plan your deployment

Read the following documents before you deploy a Secure Mesh Site in any provider environment:

• Understanding F5 Distributed Cloud - Customer Edge (CE)
• CE Datasheet
• CE Supported Platforms Guide
• Customer Edge Site Sizing Reference
• CE Performance Guide: Contact your account representative on CE performance-related information.
• Proxy for CE Registration and Upgrades Reference
• Secure Mesh Sites v2 Frequently Asked Questions
• Customer Edge Registration and Upgrade Reference
• F5 Customer Edge IP Address and Domain Reference for Firewall or Proxy Settings

Before you begin

Before you begin, make sure you have:

• A Distributed Cloud Services account. If you do not have an account, see Get Started with Distributed Cloud Console.

• Resources required per node: Minimum 8 vCPUs, 32 GB RAM, and 80 GB disk storage. For a full listing of the resources required, see the Customer Edge Site Sizing Reference guide. All the nodes in a given CE Site should have the same compute, memory, and disk storage resources. When you deploy in cloud environments, these nodes should use the same instance flavor.

• Customer Edge (CE) deployments require connectivity to F5 Distributed Cloud. See the F5 Customer Edge IP Address and Domain Reference for Firewall or Proxy Settings guide for the list of IP addresses and domain names that need to be allowed.

• F5 assumes that an existing IPv4 subnet exists with Internet connectivity to attach to the node.

• The new Secure Mesh Site workflow enables you to have up to eight interfaces. These interfaces must be in different subnets. Make sure you have the required subnets available before creating the CE Site nodes.

• To deploy the CE site with High Availability (HA) enabled, you must open the Internet Control Message Protocol (ICMP) between the CE nodes on the Site Local Outside (SLO) interfaces. This is needed to ensure intra-cluster communication checks.

• An EKS cluster with EC2 instances running. To set up a cluster, see Set up to use Amazon EKS.

• Enabled AVX (Advanced Vector Extensions) on hardware where your CEs are deployed if you're using F5 Distributed Cloud WAF. If you don't enable AVX, you can't use the AI features for F5 Distributed Cloud WAF.

Important: After you deploy the CE Site, the IP address for the SLO interface cannot be changed. Also, the MAC address cannot be changed.

Feature gaps from other providers

The following features aren't supported:

• Segment virtual routing and forwarding (VRF)
• Common virtual IP address (VIP)
• DC Cluster Group (DC-CG)
• Enhanced Firewall policy (EFP)
• Static route configuration
• Virtual Router Redundancy Protocol (VRRP) mode
• SLI Site-to-Site connectivity
• Jumbo frames
• Node-by-node upgrades
• Management network
• Horizontal scaling
• Vertical scaling

Configuration overview

To create a Secure Mesh Site for EKS:

• Site object configuration: Create and configure a Secure Mesh Site object using F5 Distributed Cloud Console.
• Node deployment prerequisites: Create objects that are associated with the CE nodes, including security groups, SSH key pairs, and more.
• Node management: Use Download Manifests deployment method to create the CE nodes. Each CE node is a virtual machine (VM).

Important: If you make changes to the custom proxy server or node selector configurations for running nodes, you must download the manifest file again and re-apply it.

Create site object

export KUBECONFIG=</path/to/the/kubeconfig/file>
   for n in ip-10-0-1-38.ec2.internal ip-10-0-2-243.ec2.internal ip-10-0-3-154.ec2.internal; do
     kubectl debug node/$n -it --image=public.ecr.aws/amazonlinux/amazonlinux:2023 -- \
       chroot /host /bin/bash -c "
         grep -q '^vm.nr_hugepages' /etc/sysctl.conf || echo 'vm.nr_hugepages=768' >> /etc/sysctl.conf
         sysctl -p
         systemctl restart kubelet
         grep -i huge /proc/meminfo"
   done

Verify CE site registration

After you deploy your nodes, they automatically register as a CE Site in Distributed Cloud Console. The registration process isn't quick.

In Distributed Cloud Console, the status changes from Waiting for Registration to Provisioning to Online. Wait a few minutes for the registration process to begin.

• In Distributed Cloud Console, go to Multi-Cloud Network Connect > Overview > Infrastructure > Sites.

• Select your CE Site.

• Confirm that the Dashboard tab shows the System Health of 100% as well as Data Plane and Control Plane both Up.

Note: For more information, see the Customer Edge Registration and Upgrade Reference guide.

Next steps

See the following documentation for additional CE Site operations:

• To monitor your CE Site, see the Monitor Site guide.
• To manage your CE Site software updates, see the Manage Site guide.
• For the latest on Distributed Cloud Services releases, see Changelogs.
• To view the various types of events generated, see the Events Reference guide.

Add a load balancer with CE deployment

Optionally, set up a load balancer with your CE deployment:

• To create an HTTP load balancer, see Create HTTP Load Balancer.

• To create a TCP load balancer, see Create TCP Load Balancer.

References

For more information, see:

• System Overview
• Core Concepts
• Networking
• F5 Distributed Cloud - Customer Edge